1. WLC402 Windows Vista: Kernel Changes Mark Russinovich Technical Fellow, Platform and Services Division Microsoft Corporation mark.russinovich@microsoft.com

2. Mark Russinovich Technical Fellow, Platform and Services Co-founder and chief software architect of Winternals Software (www.winternals.com) www.winternals.com Co-author of Windows Internals, 4th edition and Inside Windows 2000, 3rd Edition with David Solomon Author of tools on www.sysinternals.com www.sysinternals.com Home of blog and forums Senior Contributing Editor to Windows IT Pro Magazine Ph.D. in Computer Engineering

3. Outline Introduction Processes & Threads I/O and File System Memory Management Startup and Shutdown Reliability & Recovery Security

4. Scope of Talk This talk covers enhancements to the Windows Vista kernel and related core components Many other significant improvements in other kernel areas not covered (e.g. Networking, Graphics, Window Manager, Installation, Management, & Monitoring) Windows Server “Longhorn” will be a superset of Windows Vista These changes will be merged back into Windows Vista kernel with SP1 Therefore, all Windows Vista kernel changes described in this talk apply to Windows Server “Longhorn” But, server-specific changes not covered (e.g. NUMA enhancements, hot CPU add/replace, hot replace memory) * Content of this talk was co-developed with Dave Solomon (www.solsem.com)

5. Outline Introduction Processes & Threads I/O and File System Memory Management Startup and Shutdown Reliability & Recovery Security

6. Time Accounting Before, Windows accounted for CPU time based on the interval clock timer 10-15ms resolution Thread quantum expiration was not always fair A thread might get almost no turn or up to three turns Threads also were charged for interrupts that occurred while they were running Idle T1T2 T1 & T2 come out of wait; T1 begins Time slice interval

7. Cycle Time Counter Windows Vista reads Time Stamp Counter (TSC) at context switch Actual CPU cycles consumed charged to thread Interrupt time not charged Allows for more accurate quantum accounting Thread gets at least 1 turn and can get at most a turn + 1 tick Also provides accurate time accounting for thread execution Idle T1 Time slice interval T2

8. Multimedia Class Scheduler Service New service that boosts thread priorities of multimedia applications to support glitch-free audio and video streaming Implemented in Mmcss.dll (runs in a Svchost) Used by Windows Media Player 11 Threads declare themselves as multimedia: Type of activity (AvSetMmThreadCharacteristics) Relative importance (AvSetMmThreadPriority) Threads boosted into real-time for 80% of a task’s clock rate If they consume that time, they are lowered so others can run 80% can be reconfigured at HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile Realtime boost Other work Realtime boost Other work

9. Outline Introduction Processes & Threads I/O and File System Memory Management Startup and Shutdown Reliability & Recovery Security

10. Symbolic File Links Before, NTFS supported only symbolic directory links (called junctions) In Windows Vista, NTFS supports symbolic file links Like UNIX soft links (ln –s) for files Built using NTFS reparse points (like junctions) Create them with new CreateSymbolicLink API or Mklink.exe command Requires “Create Symbolic Links” privilege (by default only assigned to Administrators) Mklink can also create hard links Symbolic links are processed on the client and so can span volumes and even machines

11. I/O Completion Port Improvements I/O completion ports allow threads to wait efficiently for completion of multiple I/O requests Completed I/Os queue on the completion port Before, each completion caused unnecessary context switch to the issuing thread This might cause a delay since the thread might not run immediately to process this Windows Vista defers I/O completion to when the thread pulls the I/O off the completion port Avoids context switch, thus improving performance

12. I/O Cancellation Support Before, opens could not be cancelled Example: you browse to an off-line network share in a File Save dialog and hang for the duration of the network timeout In Windows Vista, opens and other synchronous I/O can be cancelled CancelSynchronousIo cancels a pending synchronous I/O issued by another thread CancelIoEx permits canceling all or individual I/Os from any thread (CancelIo could only cancel all I/Os issued by the calling thread) Windows Vista common control file open/save dialogs all implement cancellation Threads processing I/O can now be notified of process termination

13. I/O Prioritization Background I/O (e.g. AV scans, disk defragmenting) interferes with foreground interactive tasks (e.g. reading email) Before, only way to prioritize work was based on thread CPU priority Windows Vista introduces two types of I/O prioritization: I/O priority I/O bandwidth reservation I/O prioritization implemented by ATAPI and USB storage drivers

14. I/O Priorities I/O priority is based on the priority of the issuing thread or the explicitly set I/O priority Five levels: Critical, High, Normal, Low, Very Low High not implemented Critical only for use by memory manager Stored in Flags field of I/O Request Packet (IRP) At least one Low or Very Low I/O is processed every second Processes and threads can lower their I/O priority with SetPriorityClass, SetThreadPriority “Background mode” Used by Windows Vista background tasks like indexing and Windows Defender scans

15. Bandwidth Reservation Streaming applications (e.g. Windows Media Player - WMP) can request I/O bandwidth guarantees Specified on individual files I/O system reports back to application Optimal transfer size Number of outstanding I/Os they should maintain WMP Walk-in I/O Reserved I/O WMP

16. Outline Introduction Processes & Threads I/O and File System Memory Management Startup and Shutdown Reliability & Recovery Security

17. Dynamic System Address Space Before, system virtual address space divided into fixed regions Reason for limits on nonpaged, paged pool, system page table entries In 32-bit Windows Vista, virtual memory assigned as needed Permits larger paged, nonpaged, and session pools Supports larger terminal servers, larger desktop heap, etc. Components still cannot exceed 2 GB on 32-bit systems On 64-bit systems, address space regions are configured at their maximum for all memory sizes

18. SuperFetch™ Before: Memory was not proactively populated Memory often did not contain optimal content Windows XP improved population with the logical prefetcher, but only prefetched a single process at process startup

19. SuperFetch In Windows Vista, SuperFetch prefetches across a set of applications Takes into account frequency of page usage, usage of page in context of other pages in memory Adapts to memory usage patterns, including complex usage scenarios (e.g. the “after lunch” usage) Scenarios SuperFetch improves include: Application launch Resume from hibernate and suspend Performance after infrequent or low priority tasks execute

20. SuperFetch Implementation SuperFetch includes kernel and user-mode components Page usage data collected in kernel mode SuperFetch service (Sysmain.dll) implements storage and prefetch algorithms Stores scenario files in \Windows\Prefetch\Ag*.db Calls kernel to retrieve paging histories and pre-populate page lists Also prefetches private virtual memory (Windows XP prefetcher only did file and image data) Uses low-priority I/O for pre-fetching and pre-population Uses memory priorities (0-7) to prioritize prefetched data

21. ReadyBoost RAM is ideal for caching, but it's expensive and difficult to add External flash is cheaper and is up to 10x faster to random access (not as fast as a disk for sequential I/O) ReadyBoost uses flash to create a write-through cache between disk and RAM Supported devices include USB keys, SD cards, Compact Flash, and internal PCI express cards Data is compressed (typical 2x compression ratio) File is encrypted with random per-boot session key Implemented by ReadyBoost service and Ecache.sys volume filter driver You can look at device statistics under HKLM\Software\Microsoft\Windows NT\CurrentVersion\EmdMgmt

22. ReadyBoot On systems with more than 700 MB boot prefetch is done by ReadyBoot instead of XP-style prefetch ReadBoot is implemented by the same driver and services as ReadyBoost Service analyzes last 5 boots and derives boot plan that it stores in HKLM\System\CurrentControlSet\Services\Ecache\ Parameters At boot, the driver implements RAM cache Cache is populated as the system boots by ReadyBoost service Cache does not update to reflect disk writes Cache is torn down 90 seconds after boot Performs optimized just-in-time prefetch Typically 20% improvement over XP-style boot prefetch

23. ReadyDrive and Hybrid Hard Drives Hybrid Hard Drive (H-HHD) include a nonvolatile cache (NV Cache) Cached data can be read and written when disk is spun down Data remains in cache even when disk is powered down Cache is 50 MB - 2 TB (typically 256 MB) Host OS support required to use Cache may contain: Superfetch data, boot data, (part of) hibernate file OEM can pin data On battery, used as a write cache NV Cache OS

24. Outline Introduction Processes & Threads I/O and File System Memory Management Startup and Shutdown Reliability & Recovery Security

25. Boot Configuration Database (BCD) Before, boot mechanism was platform specific (e.g. BIOS, EFI) Windows Vista unifies the boot mechanism to be platform independent Boot.ini is replaced by the Boot Configuration Database (BCD) Abstracts firmware Unified across different OS installations Uses Unicode strings for internationalization BCD is stored in the Registry Binary format Hive is stored in \Boot\BCD Loads into HKLM\BCD00000000 Registry key security protects entries

26. BCD Management BCDEdit is the command-line management interface Uses WMI to interface to BCD BCD objects are documented in the SDK Therefore, developers can code BCD WMI scripts/applications BCD System Store Boot ManagerBoot LoaderLegacy Boot Loader Timeout Default Display Order App. Path NX Settings PAE Enabled NTLDR/BOOT.INI

27. Pre-Boot Executables Windows boot manager \Bootmgr (no extension) Launched by boot sector code Replaces first half of NTLDR (reading Boot.ini) Launches other Windows pre-boot applications Supports UEFI on Longhorn Server OS loader \Systemroot\System32\Winload.exe Replaces 2nd half of NTLDR (loading OS image, boot drivers, and System registry hive) One per OS installation

28. Other Pre-Boot Executables Windows memory diagnostic \Boot\Memtest.exe Third-parties can add boot executables Winboot can run other executables: Resume loader \Systemroot\System32\Winresume.exe Used to be implemented in Ntldr

29. Startup Processes on XP Session Manager (SMSS) created Winlogon and Csrss for each session Session creation was done serially Was bottleneck for Terminal Services Winlogon, the interactive logon manager, created: Local Security Authority (Lsass.exe) Service Control Manager (Services.exe)

30. Startup Processes on Vista In Windows Vista: Initial Smss.exe creates an instance of itself to initialize each session Permits parallel session creation: Minimum parallel session startups is 4 Maximum is number of processors Session 0 Smss runs Wininit.exe (new) Wininit starts what Winlogon used to start: Services, Lsass Also starts a new process, Local Session Manager (Lsm.exe) Session 1-n Smss’s create initialize interactive sessions Session-specific instance of Csrss.exe and Winlogon.exe

31. Session 0 Isolation Before, the console user ran in session 0 Names created by console user could collide with service and system object names Services that presented windows on the console could open the door for privilege elevation (“shatter” attacks) Session 1 Application D Application E Application F Session 0 Service A Service B Service C Application B Application A Application C

32. Session 0 Isolation In Windows Vista, the console user starts in session 1 and cannot connect to session 0 Eliminates name collisions Poorly written services can’t display windows to the user Session 1 Application A Application B Application C Session 0 Service A Service B Service C Session 2 Application D Application E Application F

33. Interactive Logon Architecture Credential Providers replace GINAs Plug into Logonui.exe Easier to write than GINAs Multiple concurrent providers are supported User selected or event driven Used to capture elevation credentials Inbox Credential providers: PasswordSmartcard WinLogon LogonUI Credential Provider 1 Credential Provider 2 Credential Provider 3

34. Delayed Auto Start Services Before, autostart services could severely impact login performance In Windows Vista, services can request delayed autostart Set by new ChangeServiceConfig2 API Stores new DelayedAutoStart value in service Registry key Service Control Manager (SCM) starts these services after the automatic start services I/O priority set to Very Low during startup Services configured this way include BITS, Windows Update client, Ehome…

35. Clean Service Shutdown Before, services had no way to extend the time allowed for shutdown After a fixed timeout (default 20 seconds), SCM was killed and system halted (while services were running) This was a problem for services that needed to flush data In Windows Vista, services can request preshutdown notification and take as long as they want to shut down If the service stops responding the system gives up on it after 3 minutes After pre-shutdown services stop, the system performs Windows XP-style shutdown for other services

36. Service Shutdown Ordering Before, there was no way for services to specify the order in which they receive shutdown notification Some services have shutdown dependencies Had to implement ad-hoc solutions In Windows Vista, services can specify shutdown order Must request pre-shutdown notification Must include their name in HKLM\System\CurrentControlSet\Control\ PreShutdownOrder

37. Reliable Sleep Transitions Before, application or driver could block standby or hibernate Often caused by bug or overly aggressive power policy User might not know and system power drain causes data loss Windows Vista does not query processes when entering sleep states User-mode notification (PBT_APMSUSPEND) timeout reduced from 20 seconds to 2 seconds Drivers can’t veto sleep transitions

38. Outline Introduction Processes & Threads I/O and File System Memory Management Startup and Shutdown Reliability & Recovery Security

39. Kernel Transaction Manager (KTM) Before, applications had to work hard to recover from errors during modification of files and Registry keys Windows Vista implements a generalized transaction manager Provide all or nothing transaction semantics Extensible through third-party resource managers Kernel Transaction Manager coordinates between transaction clients (applications) and Resource Managers Registry and NTFS enhanced to provide transaction semantics across Registry and file system operations Common Log File System (Clfs.sys) introduced in Windows Server 2003 R2 provides efficient transaction logging facilities Transactions can span modifications across one or many Registry keys, files, and volumes

40. Transaction APIs Third parties can write user-mode or kernel-mode Resource Managers Using DTC and Longhorn Server, transactions can coordinate changes across files, registry, SQL Server, Oracle, MSMQ Transactions are used by by Windows Update and System Protection

41. Volume Shadow Copy Before: No way to undo file overwrites or accidental deletes System Restore only protected against changes to system files that it knew about Windows Vista uses Volume Shadow Copy for System Restore and Previous Versions Creates point-in-time copy-on-write snapshots of live volumes Introduced in Windows XP Solved open file and consistent backup problems Used by Windows Backup Previous Versions tab introduced as Server 2003 Shadow Copies for Shared Folder feature Unified data/system protection Used by System Restore

42. Windows Error Reporting Before, unhandled exception handling was executed in context of thread incurring exception Relied on thread stack being valid Corrupt thread stacks resulted in “silent process death” In Windows Vista, unhandled exceptions send a message to the Windows Error Reporting (WER) service WER launches Werfault.exe Replaces Dwwin.exe Permits WER to be invoked for threads who’s stack is too corrupted to invoke unhandled exception filter

43. Outline Introduction Processes & Threads I/O and File System Memory Management Startup and Shutdown Reliability & Recovery Security

44. BitLocker™ Drive Encryption Before, physical access to a system could compromise even domain accounts 3rd-party utilities allow access to all unencrypted data Domain credential verifiers cached in Registry In Windows Vista, entire OS volume can be encrypted with BitLocker BitLocker requirements: Trusted Platform Module (TPM) v1.2 or USB device and USB- capable BIOS 1.5 GB unencrypted system volume

45. BitLocker™ Architecture Several supported modes for storing decryption key: TPM locked with signature of boot files And optionally user-specified PIN And optionally key on USB On external USB flash device Components: Tpm.sys for accessing TPM Fvevol.sys filter driver transparently encrypts/decrypts File System Driver Fvevol.sys Volume Manager Application User Mode Kernel Mode

46. Code Integrity Verification The OS loader and kernel performs code signature checks On 64-bit x64 platforms: All kernel mode code must be signed in order to load Identity of all kernel mode binaries is verified System audit events for integrity check failures On 32-bit platforms: Load-time checks done on all kernel mode binaries, unsigned code allowed to load But to play protected hi-def content, all loaded kernel mode drivers must be signed Event log logging of driver loads

47. Protected Processes Protected Processes prevent unauthorized access to media content Can only be created through new Protected Media Path APIs (part of Media Foundation) Used to enforce a secure path to output devices Only signed images can be mapped into a secure process Images must be signed by Microsoft 3rd Party codecs loaded into a Protected Process must be signed with Windows Media DRM certificate Can query integrity of kernel-mode Standard processes have limited access to protected processes (even with SeDebugPrivilege)

48. Address Space Load Randomization (ASLR) Prior to Windows Vista Executables and DLLs load at fixed locations Buffer overflows commonly relied on known system function addresses to cause specific code to execute The Windows Vista loader bases modules at one of 256 random points in the address space OS images now include relocation information Relocation performed once per image and shared across processes User stack locations are also randomized Kernel32 NTDLL User32 Exe XP1 Kernel32 NTDLL User32 Exe XP2 Kernel32 NTDLL User32 Exe Vista1 Kernel32 NTDLL User32 Exe Vista2

49. Service Security Improvements Before, service bugs allowed for privilege elevation attacks In Windows Vista, services apply principle of least- privilege to limit system exposure in case of compromise Service-specific SIDs permit a service’s access to objects to be limited Only required objects give SID access Firewall policy can be applied to service SID (and many Windows Vista services have this specified) Write-restricted service processes further limit write access Can only modify objects allowing WRITE for service SIDs

50. Service Security Improvements Service can specify which privileges (e.g. shutdown, audit, etc.) they require Limits power of service processes Specified in MULTI_SZ registry value under service key called RequiredPrivileges On service start, SCM computes union of all required privileges for service(s) inside service process If process token does not contain one, service start fails Privileges not explicitly specified are removed from token If no required privileges specified, assumes all privileges in process token are needed

51. User Account Control (UAC) Goal: Have users run as standard user Problem: Users run as administrators Some applications only run as administrator Solution: Make previously admin operations non-admin e.g. setting the timezone Badly-behaved non-admin apps get private virtualized views of portions of the file system and Registry Administrators run as normal users Convenient to access administrative rights

52. UAC Virtualization Images that don’t opt out (in their manifest) are virtualized Virtualization implemented in the kernel: File system: file system filter driver (luafv.sys) Registry: built-in Redirected file system locations: \Program Files, \Windows, \Windows\System32 Exceptions: System Write Protected Exe’s and DLLs Files that have executable extensions (.exe,.bat,.vbs,.scr, etc) Redirected Registry locations: HKLM\Software Exceptions: Many subkeys under Microsoft

53. UAC Virtualization Writes: redirect to per-user area \Users\ \AppData\Local\Virtual Store HKCU\Software\Classes\VirtualStore Reads: unless an exception applies per-user area is attempted first and then global location

54. UAC Elevation An executable can be marked for elevation in four ways: In its manifest file In the system’s application compatibility database Heuristic installer detection User explicitly asks for elevation

55. Elevation Consent Two types of elevation: Admin Approval Mode: Continue/cancel At logon LSASS creates admin and Limited User Account (LUA) version of admin token Winlogon creates first process (e.g. Userinit) with LUA token Over the Shoulder: prompt for admin credentials User is running in a standard user account Consent.exe presents consent/password dialog on secure desktop Child of AppInfo service (in a Service Host)

56. Process Integrity Levels Specified as new Mandatory Integrity Level (IL) SIDs in process token Low: Protected-mode IE Medium: LUA processes High: Elevated processes System: System processes

57. Object Integrity Levels Object ILs stored as IL ACE in SACL Processes, threads and tokens always have an IL ACE Files and Registry keys without an IL ACE have an implicit level of Medium Objects created by medium or higher processes are marked as medium IL Objects created by low IL processes (e.g. Protected-mode IE) are marked as low IL

58. IL Access Checks IL checked before DACL A thread can only open an object for write access if its IL is equal to or higher than that of the object A thread can open any object for read access if: It’s a non-process object If a process, thread IL must be equal or higher than process IL (prevents sensitive information leakage via memory reads) The Windows subsystem also honors integrity levels: User Interface Privilege Isolation (UIPI) Only query messages can be sent to the windows of elevated processes from LUA processes Prevents “shatter” attacks

59. Miscellaneous Changes Changes that I didn’t have time to cover: New synchronization primitives: Initialize-once Shared reader/writer locks New thread pooling infrastructure Service thread tagging Support for large-sector disks On-line NTFS chkdsk and NTFS volume resizing New kernel Advanced Local Procedure Call IPC mechanism See my two-part “Vista Kernel Changes” article to appear in the February and March issues of TechNet Magazine

60. Summary Lots of exciting changes in Windows Vista kernel in the areas of performance, scalability, reliability, and security For more information: Kernel Enhancements for Windows Vista and Windows Server "Longhorn" http://www.microsoft.com/whdc/system/vista/kernel-en.mspx MSDN Vista developer resources http://msdn.microsoft.com/windowsvista/ Driver developer resources Windows Hardware Developer Central http://www.microsoft.com/whdc/default.mspx WinHEC 2006 presentations http://www.microsoft.com/whdc/winhec/

63. ©2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.